@polderlabs/bizar-omp 0.6.4 → 0.6.6

package/docs/compatibility/supported-surfaces.json

@@ -15,7 +15,8 @@
     "dry-run migration"
   ],
   "qualified": [
-    "OMP 18.2.6 / release commit 78b753124d11f8dd3ae73e2524125890ff7c977e",
+    "OMP 18.2.7 / release commit d716bcf60ab0a2e7ece1fdf382c0d143fef1f307",
+    "OMP 18.2.6 compatibility regression",
     "OMP 18.2.5 compatibility regression",
     "OMP 18.2.4 compatibility regression",
     "Node 22 and 24 CI",

package/docs/releases/0.6.5.md

@@ -0,0 +1,12 @@
+# 0.6.5
+
+## Highlights
+
+- Qualifies the plugin against OMP 18.2.7 at release commit d716bcf60ab0a2e7ece1fdf382c0d143fef1f307.
+- Keeps OMP 18.2.6 as a separately tested compatibility version.
+- Adds `omb update` for updating the global command and refreshing its enabled OMP plugin.
+- Updates CI, release qualification, installation diagnostics, and the native-development skill fingerprint.
+
+## Validation
+
+The automated OMP compatibility workflow opens this release PR only after the packed native install qualification passes.

package/docs/releases/0.6.6.md

@@ -0,0 +1,26 @@
+# 0.6.6
+
+## Highlights
+- Dashboard overhaul: overview-first console with secondary Chat page, workspace-aware floating composer, and a unified searchable settings center with five tabs (General, Runtime, OMP config, Providers, Security). All 460 live OMP 18.2.7 settings exposed through a typed keyed config adapter with write round-trip and redaction.
+- Cross-session settings propagation: `watchOmbSettings` watches the directory holding `omb.json`; a setting change in the dashboard, another `omb agents` window, or `omp config set` is reflected in every open `omb agents` TUI within ~100 ms without restart. The daemon re-reads settings per request, so only the TUI needed the watcher.
+- Mobile chat navigation: the header Chat control reveals the console pane at narrow widths (`data-mobile-view`), `min-width:0` + `flex-wrap` eliminate horizontal overflow at every tested viewport (360/390/768/1024/1366/1920 px), `conversation-title` is an `<h2>` (one `<h1>` per page), and the header bar wraps below 1100 px.
+- Security tab Collab card: `GET /omp/collab` runs `omp collab list --json` and returns sanitized host records (instanceId, pid, sessionId, sessionName, cwd, model, startedAt, participants, relayConnected, access). The tab surfaces active collab hosts with provider/model, cwd basename, participant count, relay dot, and copy-id button. The "Refresh auth status" and "List auth methods" buttons in the same tab, previously dead, are now wired to `authAction(...)`.
+
+## Validation
+- 230/230 tests across 28 files.
+- `npm run typecheck`, `npm run build`, `npm run verify:package` (11 checks), `npm run verify:security` (275 files), `npm run pack:check` (758 files, 472.1 kB packed) all pass.
+- Cross-process propagation verified by separate OS processes (watcher imports `dist/omp/omb-settings.js`, daemon writes via `PATCH /settings`); A logged `mouseScrolling:false` ~100 ms after B's atomic temp+rename.
+- Live `GET /omp/collab` smoke against an isolated daemon: `{"hosts":[]}`, 401 without token, served HTML carries `id="collab-list"`, 96 unique DOM ids with zero duplicates.
+
+## Merged PRs
+- #63 `feat/dashboard-ux-fixes` (`cb90949`)
+- #64 `feat/settings-propagation` (`013ebe9`)
+- #65 `feat/collab-urls` (`b3b4d56`)
+
+## Release commit
+`9397731` (Merge PR #65) on `main`.
+
+## Deliberate limits in this release
+- `omp collab link` is not called from the dashboard (it rotates access tokens and is interactive). Link minting stays in the terminal.
+- Auth-broker writes remain terminal-only (`OMP_AUTH_ACTIONS = {"status","list"}`).
+- URL-type OMP settings are not duplicated into a second card; they stay editable in the existing typed OMP config tab.

package/docs/releases/native-stable.md

@@ -1,3 +1,3 @@
 # Native release policy
 
-The package is releasable when typecheck, tests, packed-install qualification, and documentation checks pass against the supported OMP/Bun baseline. A GitHub release is created from an exact `v<version>` tag; npm publication uses trusted publishing. See npm-publishing.md for setup and 0.4.5.md for the current release notes. A passing release gate does not imply every native provider or worker route has been tested.
+The package is releasable when typecheck, tests, packed-install qualification, and documentation checks pass against the supported OMP/Bun baseline. A GitHub release is created from an exact `v<version>` tag; npm publication uses trusted publishing. See npm-publishing.md for setup and 0.6.6.md for the current release notes. A passing release gate does not imply every native provider or worker route has been tested.

package/docs/releases/support-matrix.md

@@ -4,7 +4,7 @@
 | --- | --- |
 | Node | 22.x and 24.x in CI |
 | Bun | 1.3.14 compatibility job |
-| OMP | 18.2.6 at release commit `78b753124d11f8dd3ae73e2524125890ff7c977e`; 18.2.5 and 18.2.4 remain regression-qualified |
+| OMP | 18.2.7 at release commit `d716bcf60ab0a2e7ece1fdf382c0d143fef1f307`; 18.2.6 remains regression-qualified |
 | Install | `npx --yes @polderlabs/bizar-omp setup` is the supported full install; `omp plugin install <package-spec>` is extension-only and `omp plugin link <checkout>` is for development |
 | Security | Trusted in-process extension; native task isolation required for managed editing |
 | Workflow state | Journal v2 validation, candidate-bound acceptance, bounded inspection/projection, and offline evidence bundles are locally qualified; v1 state remains legacy input |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar-omp",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Native oh-my-pi engineering workflow extension with typed evidence and serialized integration.",
   "type": "module",
   "engines": {
@@ -65,7 +65,9 @@
   },
   "dependencies": {
     "@trayjs/trayjs": "^0.0.10",
+    "gsap": "^3.15.0",
     "ink": "^7.1.1",
-    "react": "^19.3.0"
+    "react": "^19.3.0",
+    "yaml": "^2.9.1"
   }
 }

package/skills/omp-native-development/SKILL.md

@@ -9,7 +9,7 @@ Treat this skill as a source-grounded engineering procedure, not an assertion of
 
 ## Establish the target before implementing
 
-Read [accuracy-and-versioning.md](references/accuracy-and-versioning.md) first. The current qualification target is `can1357/oh-my-pi` v18.2.6 at commit `78b753124d11f8dd3ae73e2524125890ff7c977e`; OMP 18.2.5 and 18.2.4 remain separately tested compatibility versions. The bundled research corpus remains pinned to main commit `dbf3afad4894bde827d90f965e77b3fe1c5a95e5`, dated 2026-09-17, and must not be presented as the current release source.
+Read [accuracy-and-versioning.md](references/accuracy-and-versioning.md) first. The current qualification target is `can1357/oh-my-pi` v18.2.7 at commit `d716bcf60ab0a2e7ece1fdf382c0d143fef1f307`; OMP 18.2.6, 18.2.5, and 18.2.4 remain separately tested compatibility versions. The bundled research corpus remains pinned to main commit `dbf3afad4894bde827d90f965e77b3fe1c5a95e5`, dated 2026-09-17, and must not be presented as the current release source.
 
 Record the developer's actual OMP package version, lockfile/integrity, source commit when available, Bun version, execution mode, profile, cwd, and relevant settings. Never print secrets. Verify the exact exports and behavior of that target, rather than assuming these snapshots apply unchanged. A missing environment or unrun test means UNKNOWN or NOT RUN, never PASS.
 

package/skills/omp-native-development/references/accuracy-and-versioning.md

@@ -18,8 +18,8 @@ Separate five kinds of statement: DOCUMENTED, SOURCE-OBSERVED, TESTED, PROPOSED
 
 ## Target fingerprint
 
-Current qualification target: `v18.2.6@78b753124d11f8dd3ae73e2524125890ff7c977e`, npm integrity `sha512-dk298PZNnD1QigR4lKvQpWVAAbIo2bCfdNOlZwGFZsxHbP+XYrUS+AxYxfWkfqSnFRliP9Ho+h94DHV3o6lxRg==`.
-Previous compatibility targets: `v18.2.5@37273117021129e96bd05d8277b140ec3fd61990` and `v18.2.4@1c0303b1f2ec515cbf4b44a9a49d68a029531aac`.
+Current qualification target: `v18.2.7@d716bcf60ab0a2e7ece1fdf382c0d143fef1f307`, npm integrity `sha512-lVNXaRv5US4DTa79djiicoL3Mil284nKiZLReMd2j7XcwfVI2Bnx9yy0UQ1NevbhF/e0LtQ+fk6OSgEy9N3tew==`.
+Previous compatibility targets: `v18.2.6@78b753124d11f8dd3ae73e2524125890ff7c977e`, `v18.2.5@37273117021129e96bd05d8277b140ec3fd61990` and `v18.2.4@1c0303b1f2ec515cbf4b44a9a49d68a029531aac`.
 Research source: `can1357/oh-my-pi@dbf3afad4894bde827d90f965e77b3fe1c5a95e5`; it remains a source/documentation corpus pin, not a claim about the current package release. Compare artifacts/commits, not just a semver string.
 
 Record the installed package name/version, lockfile integrity or binary checksum, source SHA when available, Bun version, OS/architecture, execution mode, profile, agent directory, cwd, project settings and overlays. Include which facts are unavailable. Do not assert an installed binary's source commit solely because its version matches a Git tag.

package/skills/omp-native-development/references/source-manifest.json

@@ -5,9 +5,9 @@
   "reference_date": "2026-09-17",
   "docs_tree_sha": "c0055f49ceb172ff6da9490cf74773e9b187966b",
   "current_qualification": {
-    "tag": "v18.2.6",
-    "commit": "78b753124d11f8dd3ae73e2524125890ff7c977e",
-    "npm_integrity": "sha512-dk298PZNnD1QigR4lKvQpWVAAbIo2bCfdNOlZwGFZsxHbP+XYrUS+AxYxfWkfqSnFRliP9Ho+h94DHV3o6lxRg==",
+    "tag": "v18.2.7",
+    "commit": "d716bcf60ab0a2e7ece1fdf382c0d143fef1f307",
+    "npm_integrity": "sha512-lVNXaRv5US4DTa79djiicoL3Mil284nKiZLReMd2j7XcwfVI2Bnx9yy0UQ1NevbhF/e0LtQ+fk6OSgEy9N3tew==",
     "qualification": "Runtime-qualified by the Bizar packed-install contract; the bundled docs/source inventory remains pinned to the research commit below."
   },
   "comparison_release": {